Owner's manual

How this website works

Access confirmed.

Kat, read this part first

I built this site and I run it. This page is here in case I am not around to do that. It is not a to-do list and it is not something you have to keep up with. It is a map, so that if you ever need to hand this off, or just need to know who to call, you are not starting from nothing.

Nothing on this page can break the website. It is a description, not a set of controls. You can read it, print it, and then ignore it for a year.

You do not need to understand all of it. You need to know that each piece exists and where to look. That is the whole job of this page.

The short version

Your website is six separate pieces. Each one does one job. The accounts are yours and use kat@lazykhorsemanship.com.

Squarespace holds the name lazykhorsemanship.com.
Firebase (Google) stores the pages, serves them to visitors, and keeps the member accounts and their saved horse records.
Google Workspace runs your email.
Square takes membership and merch payments.
Printful prints and ships the merch after Square says it was paid for.
The site files themselves are written on a computer and uploaded.

Because all of it sits on your Google account, you already own the whole thing. Nobody has to release it to you. That was on purpose.

The one thing to protect

The Google account kat@lazykhorsemanship.com is the key to nearly everything here. Hosting, the database, the email, the analytics. Keep the password somewhere safe and keep the two-step verification working. If you lose that account, getting it back is harder than anything else on this page.

The only urgent part

Three things that need a person

The rest of this site runs without anybody watching it. These three can need you because they involve somebody's money or an order that has gone wrong.

1. Renewals that could not be confirmed

Every night the site asks Square whether each paying member is still current. Sometimes Square says the subscription is there but the payment has not come back confirmed. A renewal that quietly went through and one that quietly failed look exactly the same from the outside, and they need opposite responses, so the site refuses to guess.

It writes the case down instead, in a list called reconciliationAlerts. Nothing emails you about it, and it does not appear in your admin portal. A member loses access about three days after an unconfirmed renewal, so you have roughly a two day window. You have to go and look.

How to look:

Open the Firebase console and choose Firestore Database.
In the list of collections on the left, click reconciliationAlerts. If it is not there, there have never been any, which is good news.
Any row with resolved set to false is waiting for a person. Each row explains itself in plain English in its reason field.
Copy the squareSubscriptionId from the row and look that subscription up in Square.

Then: if the payment actually landed, they keep their access and you can set resolved to true. If it did not, they were never charged, and losing access is the right outcome. Either way, say so to the member before they find out by being locked out.

Checking this once a week is enough. If it starts happening often, that is a sign something is wrong with the connection to Square and is worth handing to a developer rather than working through by hand.

2. Refunds and disputes

If you refund somebody in Square, the website does not find out. Their access stays on until a person turns it off. If a customer disputes a charge with their bank, nothing about it reaches the website at all. It only shows up in Square.

What to do: the written procedure is in REFUNDS-AND-DISPUTES.md in the project folder. Whoever is helping you with the site can open it.

3. Merch orders with a problem

A normal merch order goes from Square to Printful without you copying or typing anything. If a customer says they paid but the order is not moving, check the payment in Square first, then check Orders in Printful.

Merch orders do not appear in this admin portal. Square shows the payment. Printful shows printing, shipping and tracking.

Never send an order to Printful just because a customer opened a checkout page. Only a completed Square payment is proof that they paid.

If you need to stop taking money right now

There are two separate switches in Firebase. They stop new sales without rebuilding the website.

config/billing controls new Horse Hub Plus subscriptions.
config/merch controls new merch checkouts.

Open Firestore Database, open the right record, and set enabled to false. New checkouts for that one part stop right away. Existing memberships and orders are not canceled.

Setting it back to true opens that checkout again. If you are unsure which switch you need, set only the one named above and ask for help.

The trap

Three companies with almost the same name

This has already caused one real outage, so I am putting it near the top. Three different services touch your website and two of them are named almost identically. They have nothing to do with each other.

Which is which
Name	What it is for you	Careful
Squarespace	Holds the name lazykhorsemanship.com. Nothing else. No website, no email.	Never cancel this account. Canceling it gives up your domain name.
Square	Takes the card payments. Also still hosts your old website at lazy-k-horsemanship.square.site.	That old Square site is out of date. The real one is lazykhorsemanship.com.
Google Workspace	Your email, kat@lazykhorsemanship.com.	Billed separately from everything else.

Squarespace is not a website subscription you are paying for by mistake. It looks like one. It is not. It is the registration of your domain name, and it is the only reason typing lazykhorsemanship.com finds you at all. Google used to sell domain names, sold that part of the business to Squarespace, and your registration went along with it. It is paid through 11 July 2027.

The map

The six pieces, one at a time

If it helps: the domain is your address on a signpost. The hosting is the building the address points at. The site files are what is inside the building. The database is the filing cabinet in the back. Square is the cash register by the door. Printful is the workshop and shipping desk.

1. The domain name. Squarespace.

The name lazykhorsemanship.com is registered to Lazy K Horsemanship and is managed at account.squarespace.com/domains. It is locked against being transferred away and is paid through 11 July 2027.

Inside that account is a DNS panel. DNS is the short list of instructions that tells the internet where your name points. It matters more than it looks like it should. In August 2026 these entries got deleted by mistake, because they looked like leftovers from the old website, and the domain stopped working inside an hour. The site itself was never down. Only the signpost pointing at it. These are the four entries and they should not be changed:

The DNS records for lazykhorsemanship.com
Host	Type	Value	What it does
`@`	A	`199.36.158.100`	Points the bare domain at the website.
`www`	A	`199.36.158.100`	Makes the www version work too.
`@`	MX	`smtp.google.com` (priority 1)	Sends your email to Google.
`@`	TXT	`hosting-site=lazy-k-horsemanship`	Proves to Google you own the name.

If the site is unreachable and you have not changed anything, DNS is the first place to look. The symptom is odd: it quits in some browsers before others. Firefox can keep showing the site for hours after Chrome and Safari have given up, because Firefox looks addresses up differently. So "it works on my phone" does not mean it is fine. The full account of the 2026 outage and how it got fixed is in DNS-RECOVERY-2026-08-26.md.

2. The hosting. Firebase.

The site is served by Firebase Hosting, which is Google's. The project is called lazy-k-horsemanship and it is at console.firebase.google.com, under your Google account.

Your site has two working addresses. This is worth remembering:

lazykhorsemanship.com is the real one, the one you give people.
lazy-k-horsemanship.web.app is a spare that Google provides. It does not depend on Squarespace or on DNS at all.

If the first one stops working and the second still works, the website is fine and the problem is the domain name. That one test tells you which company to call.

3. The site files.

The pages are ordinary files. Text, pictures, and the code that makes the calculators run. They are not edited in a website builder you log into. They get written on a computer and uploaded. That has one consequence I want to be straight with you about: right now you cannot change the wording on a page yourself. Somebody with the project files does it and re-uploads. See the handover section below.

4. The database. Firestore.

Also part of Firebase. This holds member accounts, their horses, saved calculations, trail reports, and the record of who has paid. You can read all of it in plain form through your admin portal, which is the way it is meant to be looked at. The raw version is in the Firebase console under Firestore Database.

5. The payments. Square.

Money is taken by Square, at squareup.com/dashboard. Square takes payment for Horse Hub Plus and for merch. Card numbers never touch your website. A buyer is handed to Square and pays on Square's page. For a membership, Square tells the website to switch access on. For merch, Square tells the website that the order is paid and ready to print.

That was a deliberate choice and it is worth keeping. Because the site never stores a card number, a break-in at the site could not expose one.

6. Merch printing and shipping. Printful.

Printful makes each shirt or hoodie only after it is ordered. It is at printful.com. Printful holds the product artwork, charges your saved billing method for making and shipping the item, prints it, and sends it to the customer.

Square and Printful do different jobs. The customer's money arrives in Square. Printful's cost is charged to you separately. The prices on the website are set high enough to cover the item, Printful's tax where it applies, shipping, Square's fee, and a small amount left for Lazy K.

The merch store

How an online merch order works

The store is live

Customers can open lazykhorsemanship.com/merch, choose an item, color and size, and pay. The store ships within the United States.

The customer chooses a product, color, size and quantity on the merch page.
They enter their state and ZIP code. The site asks Printful for the current shipping cost for that exact order. The shipping line also covers the percentage Square deducts from that amount.
Square opens a secure payment page. The customer enters their full name, address and card information there.
The website waits for Square to say the payment is completed. Opening checkout is not enough.
After completed payment, the website sends the exact product and address to Printful one time. It is built to refuse a duplicate message rather than print twice.
Printful charges your saved billing method, prints the item and ships it to the customer.

Look in Square for money

Use Square to confirm that a payment completed, see what the customer paid, issue a refund, or answer a card dispute.

Open Square

Look in Printful for the package

Use Printful to see whether an order is waiting, printing, shipped, on hold or failed. Tracking also lives there.

Open Printful orders

What you normally have to do

Nothing. A paid order should move to Printful on its own. You do not copy the order, type the address again or pay Printful by hand. Check the two dashboards if a customer asks where an order is or if Printful says an order needs attention.

If something is wrong, damaged or missing

Ask for the customer's order number. For damage or a misprint, ask for one clear photo.
Confirm the payment in Square.
Find the matching order in Printful and use its problem report or support option.
Follow the promise on the merch returns page. A damaged, misprinted or lost item can be replaced or refunded within 30 days. A wrong size or change of mind is not returnable because every item is printed for that order.

Do not use the old Shopify store for new orders

The merch store on this website uses Square and Printful. It does not use Shopify. The older May Shopify orders are separate and do not get fixed by this new store. Printful still shows two older orders waiting for fulfillment, so they need their own decision. Do not charge or resend either one until you have checked the original payment and spoken with the customer.

Changing products or prices

Do not change a product in only Square or only Printful. The website has one catalog that controls the product, color, size and price the customer sees and the exact Printful item that gets made. Ask the person working on the site to update that catalog, rebuild, test and upload it.

Money going out

What it costs to run

Five costs. Square and Printful change with each sale. The others do not.

What	Roughly	Notes
Domain name (Squarespace)	Yearly	Paid through 11 July 2027.
Email (Google Workspace)	Monthly, per person	Only if you keep the custom address.
Hosting and database (Firebase)	Usually nothing	See below.
Square	A cut of each sale	No monthly fee. Online payments are charged a percentage plus 30 cents.
Printful	Each merch order	No monthly fee. It charges the item, shipping and any fulfillment tax when the order is sent to print.

Firebase is on a pay as you go plan called Blaze. That sounds worse than it is. There is a large free allowance every month and a site this size normally sits inside it and gets billed nothing. A $300 trial credit covers the account until roughly late November 2026. When that runs out nothing breaks and nothing switches off. The free allowance just carries on.

A budget alert is not a spending cap

There is a $10 a month budget alert on the account. It emails you. It does not stop anything. Google has no way to hard stop spending short of disconnecting billing entirely, and that would take the site down. So the real protection is built into the site: limits on how much work it will do, sign in required for the expensive parts, and photos shrunk before they get stored. If one of those alert emails ever shows up, show it to whoever is helping you. It usually means something is misbehaving, not that you got popular overnight.

Keys

Who can get in, and how you change it

Access to the private parts of the site is not a shared password. Each person signs in with their own Google account, and what they can see is set by a role recorded against them. That means you can take one person's access away without changing anything for anybody else.

Role	Can see	Granted from
Owner administrator	Everything. Member records, payments, roles.	Firebase console only. Deliberately not from the website.
Care viewer	Member and horse records. Changes nothing, grants nobody.	Your admin portal.
Trail moderator	Trail reports and photos waiting for review.	Your admin portal.
Manual reader	This page only. No member records at all.	Your admin portal.

One role per person

Somebody has one role, not a collection of them. The website will not let you change a person's role from Care viewer to Manual reader, or add a second one: it refuses rather than quietly overwriting what they already have. To change somebody's role, suspend the one they have, then have the new one set up in the Firebase console.

The list above is four separate jobs, not four rungs of a ladder. An owner administrator can read everything including this manual. A Care viewer or a Trail moderator cannot read this manual, even though their roles sound bigger.

Giving somebody this manual

To let a bookkeeper, an accountant or a new developer read this page without handing them your clients' private records, use Manual reader. Here is how:

Have them go to the website and sign in once with Google. Nothing works until they do, because the site has to know who they are before it can give them anything.
Open your admin portal and find Team access.
Type their name or email. The portal shows you who it matched before it saves anything, so you can check it is the right person.
Pick Manual reader, leave the status on Active, and save.

To take access away, set their status to Suspended. Do not delete anything. Suspending keeps the record that they once had access, which is exactly what you want if you ever have to work out who could see what, and when.

Why you cannot make another owner administrator from the website

This looks like something I forgot. It is on purpose. Creating a full owner administrator can only be done in the Firebase console, by hand. Here is the reason. If somebody ever got into an administrator's signed in browser, the worst they could do is misuse that one session, and you can end a session. They could not quietly create a second administrator account for themselves and still be sitting there after you locked the first one out.

The steps for adding an owner administrator are written down in ADMIN-ROLE-SETUP.md in the project folder.

When something looks wrong

Working out what actually broke

Start here instead of assuming the worst. Most of the alarming symptoms have boring causes.

The site will not load at all

Try lazy-k-horsemanship.web.app.

That works? The website is healthy and the domain name is the problem. Look at Squarespace and the DNS entries above.

That does not work either? Then it is the hosting. Check Firebase status. If Google is having an outage, everybody is, and waiting is the fix.

Something looks wrong on one page

A wrong price, a broken calculator, a typo. Nothing is on fire and no member data is at risk. It needs whoever holds the project files to change it and re-upload.

Write down the exact page address and what you expected to see instead. That is genuinely most of the work of fixing it.

A member says they paid and got no access

Known case, and the portal already handles it. Open your admin portal, go to Payments, and look at Payments nobody could match. Usually it means they paid with a different email than the one they signed up with. Grant them access there and mark it handled.

Email stopped arriving

Email is Google Workspace and it is separate from the website. The site can be perfect while email is broken, and the other way round. Check the Workspace account is paid, then check the MX entry in the table above still says smtp.google.com.

A merch buyer paid but Printful has no order

Do not make a second charge and do not type the order into Printful yet. Find the completed payment in Square, then look in Printful by the same date and customer.

If it is missing, save the Square payment number and a screenshot of both pages. Give those to the person helping with the website. The order record is in merchOrders in Firestore.

A merch package is late, wrong or damaged

Find it in Printful. Tracking and production problems belong there. Get the order number and, for damage or a misprint, one clear photo from the customer.

Use the merch returns page as the promise you follow. Do not promise a size exchange that the page says is not available.

There is always a way back

Every significant change is saved with a label, and full copies of the site are kept as dated backup files. If a change ever makes things worse, the previous version can be put back. A developer does that in minutes and does not have to figure out what changed first. The current labeled good version is known-good-2026-08-28-refunds-and-signin, written up in RESTORE-POINT-2026-08-28.md.

Say those words to whoever is helping and they will know what you mean.

If I am not around

Handing this to somebody new

This is the part I actually wrote the page for. You are not stuck and you are not starting over, and the reason is simple: every account is already in your name. Nobody has to release anything to you. A new person needs to be let in. They do not need to be handed the keys, because you have them.

What to tell them, in this order

The site is a static site generated by Python, hosted on Firebase Hosting, with Firestore for data, Cloud Functions connecting Square payments to memberships and merch, and Printful printing paid merch orders. That one sentence tells a developer most of what they need to know.
The project files are a Git repository in the Website folder, with the full history of every change.
The source is in Website/_build/. You edit a content_*.py file, run python3 _build/build.py, and it rebuilds every page from that one source so they cannot end up disagreeing with each other. It refuses to build if a link is broken.
Uploading is npm run build && npm run stage, then npx firebase-tools deploy --only hosting.
There are more than 2,200 automated tests. npm run test:node runs them. Ask them to run it before and after any change they make.

The documents to give them, in reading order

All of these are in the Website folder. They are thorough, and they explain why things are the way they are, not just what they do.

README.md. What every file is and how to rebuild.
HANDOFF.md. The state of everything, section by section.
ADMIN-ROLE-SETUP.md. How to grant an owner administrator.
BILLING.md. The real measured running costs.
SQUARE-SETUP.md and REFUNDS-AND-DISPUTES.md. Membership payments.
MERCH-INTEGRATION-FINDINGS-2026-09-05.md. Merch products, prices, Square and Printful.
ENTITLEMENTS.md. How paid access is decided.
DNS-RECOVERY-2026-08-26.md. Read before touching DNS.
RESTORE-POINT-2026-08-28.md. How to get back to a known good version.

The passwords are deliberately not on this page

Anybody who knows the exact file to ask for can read this page. The sign in above keeps it tidy. It does not make it a secret. So there is no password, account number or recovery code written here, and none should ever be added.

Those belong on a separate sheet called Accounts and Access that is not on the website. Keep it in a password manager, or printed somewhere safe with your other business papers. It lists the six pieces named on this page and who can get into each one. If that sheet does not exist yet, making it is the best hour you could spend on any of this.

Take a copy

Keep this somewhere that is not the website

A manual that only exists inside the thing it describes is no good on the day that thing is broken. Take a copy now and put it somewhere you could get to with the site down and no internet. Printed in a drawer, or a file on your phone.

The text file gets built from this page in your browser, so it always matches what you just read. Email it to a new developer and they have the whole picture before they ask you a single question.

Keeping this page honest

This describes the site as it stood on 5 September 2026. If somebody changes how payments, hosting or the domain work, this page has to change with it. Its source is _build/content_manual.py. A manual that is quietly out of date is worse than none, because it gets believed.

Checking access

Sign in with your Lazy K Google account.

Access denied